Researchers: 538K Huawei Android devices have Joker malware, via ten apps in Huawei's AppGallery, after Play Store's similar issues with Joker-infected apps
what you need to know
Context & Ripple Effects
Joker is a repeat offender on Android: after its earlier run through Google Play and third-party marketplaces alongside Gooligan-era ad-fraud, researchers have now found it on 538K Huawei devices via ten apps in Huawei's own AppGallery. The corpus shows this is a structural pattern, not a one-off — over a million users hit through seven Play Store apps in 2018, ad-fraud code in 24 children's games in 2020, and Malwarebytes flagging a repeat developer still live on Play in 2022.
The significance for Huawei is reputational as much as technical: AppGallery is the storefront Huawei positions as an alternative to Play, and it is now exhibiting the same detection-lag problem that has plagued Google's store for a decade.
First-order effects
- Owners of the 538K infected Huawei devices face unwanted subscriptions and ad fraud until the ten apps are removed and uninstalled.
- Huawei must pull the flagged apps from AppGallery and answer questions about why its review pipeline missed what researchers caught.
Second-order effects
- Google gains a talking point on relative store safety, while Huawei faces pressure to invest more in automated malware screening as AppGallery scales outside China.
- Security vendors see sustained demand: the recurrence of Joker-class families across both stores keeps enterprise mobile-threat-defense budgets justified.
Third-order effects
- If every major Android storefront — Play, third-party marketplaces, and now AppGallery — keeps admitting the same malware families post-publication, the industry's trust model shifts toward endpoint-level protection and government advisories rather than store curation.
- Given later government warnings over China-linked Android spyware, incidents like this give Western buyers another reason to scrutinize Huawei's software supply chain, independent of the chip-export fight.
The trend: Subscription-fraud malware families like Joker keep cycling through whichever Android app store is growing fastest, with researcher discovery consistently outrunning store vetting.